Reducing exposures to an acceptable level means:

a. All controls implemented are reliable

b. Residual losses have been eliminated

c. Threats for which no control exists have a low probability of occurrence

d. The costs of implementing and operating further controls exceed the reduction in expected losses that will occur